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EXAMINER'S ANSWER 



This is in response to the appeal brief filed 6/30/2008 appealing from the Office 
action mailed 11/01/2007. 
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Art Unit: 2132 

(1) Real Party of Interest 

A statement identifying by name the real party in interest is contained in the brief 

(2) Related Appeals and Interferences 

The examiner is not aware of any related appeals, interferences, or judicial 
proceedings which will directly affect or be directly affected by or have a bearing on the 
Board's decision in the pending appeal. 

(3) Status of Claims 

The statement of the status of claims contained in the brief is correct. 

(4) Status of Amendments After Final 
No amendment after final has been filed. 

(5) Summary of Claimed Subject Matter 

The summary of claimed subject matter contained in the brief is correct. 

(6) Grounds of Rejection to be Reviewed on Appeal 

The appellant's statement of the grounds of rejection to be reviewed on appeal is 
correct. 

(7) Claims Appendix 

The copy of the appealed claims contained in the Appendix to the brief is correct. 

(8) Evidence Relied Upon 

5,623,600 Jietal 4-1997 

5440723 Arnold et al 8-1995 
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(9) Grounds of Rejection 

The following ground(s) of rejection are applicable to the appealed claims: 
Claim Rejections - 35 USC § 103 

Claims 1-20 are rejected under 35 U.S.C. 103(a) as being unpatentable over Ji et 
al (5,623,600) in view of Arnold et al (5,440,723). 

Ji teaches with respect to claim 1 , a method comprising: receiving (by a server) 
computer data (files) from a first computer (i.e. a node from which the files came) for 
transmission to a second computer (i.e. a recipient node which is to receive the files) via 
a network (figure 1 element 28); and screening (figure 8B) the computer data for at least 
one virus before communicating the computer data to the second computer (see Ji 
Abstract, column 3 lines 52-63 and column 10 lines 26 - column 1 1 line 40). Ji does not 
teach wherein said screening comprises creating a model of the second computer, 
installing a program contained in the computer data on the model and screening the 
model for the at least one virus. Arnold teaches wherein said screening comprises 
creating a model of the second computer, installing a program contained in the 
computer data on the model and screening the model for the at least one virus (see 
column 8 line 28-60). It would have been obvious at the time the invention was made to 
a person having ordinary skill in the art to which said subject matter pertains to have 
install the computer data on a model machine to check of virus because it is the safest 
and most reliable way of check for viruses (see column 8 line 28-60). Therefore one 
would have been motivated to have installed computer data on a model machine for the 
scanning of viruses. 
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With respect to claim 2, wherein the network comprises an IP network (see Ji 
column 4 lines 17-32). 

With respect to claim 3, if the at least one virus is detected, performing at least 
one of the following: (i) inhibiting communication of at least a portion of the computer 
data to the second computer; (ii) removing the at least one virus from the computer data 
prior to transferring the computer data to the second computer; (iii) communicating a 
message indicating that the at least one virus was detected to the second computer; (iv) 
communicating a message indicating that the at least one virus was detected to the first 
computer; and (v) writing data to a database indicating that the at least one virus was 
detected (see Ji figures 8A, 8B, 8C and column 1 1 lines 6-40). 

With respect to claim 4, receiving computer data from the second computer for 
transmission to the first computer; and screening the computer data received from the 
second computer for at least one virus before communicating the computer data 
received from the second computer to the first computer (see Ji Abstract, column 3 lines 
52-63 and column 1 0 lines 26 - column 1 1 line 40 i.e. node 33 also performs virus 
detection on all messages being transmitted into or out of an associated network). 

With respect to claim 5, a virus screening device operative to be connected to a 
network and operative to screen computer data received from a first compute (e.g. an 
element 30 in network 22) for at least one virus before communication the computer 
data to a second computer (e.g. an element 30 in network 24), the virus screening 
device (see figure 1 , column 3 lines 52-63 and column 1 0 lines 26 - column 1 1 line 40). 
Ji does not teach a model of the second computer, the model configured to have a 
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program contained in said computer data installed thereon, and wherein said model is 
further configured to be screened for the at least one virus. Arnold teaches a model of 
the second computer, the model configured to have a program contained in said 
computer data installed thereon, and wherein said model is further configured to be 
screened for the at least one virus (see column 8 line 28-60). It would have been 
obvious at the time the invention was made to a person having ordinary skill in the art to 
which said subject matter pertains to have install the computer data on a model 
machine to check of virus because it is the safest and most reliable way of check for 
viruses (see column 8 line 28-60). Therefore one would have been motivated to have 
installed computer data on a model machine for the scanning of viruses. 

With respect to claim 6, wherein the network comprises an IP network (see Ji 
column column 4 lines 17-32 i.e). 

With respect to claim 7, wherein a configuration associated with the second 
computer routes communicated data to the virus screening device (see column 3 lines 
52-63 node 33 also performs virus detection on all messages being transmitted into or 
out of an associated network, and column 10 lines 26 - column 1 1 line 40). 

With respect to claim 8, a third computer communicatively linked to the second 
computer via a local area network (see figure 1 e.g. there is many element 30 in 
network 24), wherein the virus screening device resides outside the local area network 
(see figure 1 e.g. node 26). 

With respect to claim 9, wherein the computer data comprises an electronic mail 
message (see Ji Abstract i.e. SMTP). 
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With respect to claim 10, wherein the computer data comprises data requested 
by the second computer from the first computer (see Ji Abstract, column 6 lines 55 - 
61). 

With respect to claim 1 1 , a method comprising: receiving screened data from a 
network-based virus screening device configured to screen data for at least one virus 
before communicating the data to a first computer; and forwarding the screened data to 
the first computer (see Ji Abstract, column 3 lines 52-63 and column 10 lines 26 - 
column 1 1 line 40). Ji does not teach wherein said screening comprises creating a 
model of the second computer, installing a program contained in the computer data on 
the model and screening the model for the at least one virus. Arnold teaches wherein 
said screening comprises creating a model of the second computer, installing a program 
contained in the computer data on the model and screening the model for the at least 
one virus (see column 8 line 28-60). It would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject 
matter pertains to have install the computer data on a model machine to check of virus 
because it is the safest and most reliable way of check for viruses (see column 8 line 
28-60). Therefore one would have been motivated to have installed computer data on a 
model machine for the scanning of viruses. 

With respect to claim 12, receiving a request for requested data from the first 
computer; sending the request across a network to a second computer; and requesting 
that the requested data be returned via the network-based virus screening device (see 
Ji figures 6A, 6B, and 6C and column 6 lines 55 - column 9 line 26). 
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With respect to claim 13, wherein the network comprises an IP network (see Ji 
column column 4 lines 17-32). 

With respect to claim 14, wherein the network-based virus screening device 
resides within a wide area network, and wherein the method further comprises: 
receiving across a local area network (see figure 1 element 22) a request for requested 
data from the first computer; sending the request across the wide area network to a 
second computer (see figure 1 e.g. element 30 in node 22 sends data to element 30 in 
network 26); and requesting that the requested data be returned via the network-based 
virus screening device (see Ji figures 1 , 6A, 6B, and 6C and column 6 lines 55 - column 
9 line 26). 

With respect to claim 15, receiving a request for requested data from the first 
computer at a modem external to the first computer (see figure 1); and initiating 
communication of the request from the modem across an IP network to a second 
computer (see Ji column column 4 lines 17-32 i.e). 

With respect to claim 16, forwarding a request to terminate a virus screening 
function of the network-based virus screening device (see Ji column 1 1 lines 6-40 i.e. 
do nothing and transfer mail message). 

With respect to claim 17, configuring the network-based virus screening device to 
inhibit communication of at least a portion of the requested data (see Ji column 1 1 lines 
6-40). 

With respect to claim 18, configuring the network-based virus screening device to 
inhibit communication of executables to the first computer (see Ji column 1 1 lines 6-40). 
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With respect to claim 19, wherein the network-based virus screening device 
resides within a wide area network, and wherein the method further comprises: 
configuring the network-based virus screening device to inhibit communication of 
executables to the first computer (see Ji column 1 1 lines 6-40); and configuring an 
electronic mail system associated with the first computer to route messages addressed 
to the first computer through the network-based virus screening device (see Ji figure 6A, 
6B, 6C and column 6 lines 55-9 line 26). 

With respect to claim 20, wherein the first computer is communicatively coupled 
to a local area network and the network-based virus screening device resides outside a 
firewall associated with the local area network, and wherein the method further 
comprises: configuring the network-based virus screening device to inhibit 
communication of executables to the first computer (see Ji column 1 1 lines 6-40); and 
configuring an electronic mail system associated with the first computer to route 
messages addressed to the first computer through the network-based virus screening 
device (see Ji column 1 1 lines 6-40). 

(10) Response to Argument 

Applicant's arguments have been fully considered but they are not persuasive. In 
response to applicant's argument that the references fail to show certain features of 
applicant's invention, it is noted that the features upon which applicant relies (i.e., that 
all virus screening at the application level) are not recited in the rejected claim(s). 
Although the claims are interpreted in light of the specification, limitations from the 
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specification are not read into the claims. See In re Van Geuns, 988 F.2d 1 181 , 26 
USPQ2d 1057 (Fed. Cir. 1993). 

In response to applicant's argument that Arnold scans for virus at least in part at 
the application level while Ji scans for virus below the application level, the test for 
obviousness is not whether the features of a secondary reference may be bodily 
incorporated into the structure of the primary reference; nor is it that the claimed 
invention must be expressly suggested in any one or all of the references. Rather, the 
test is what the combined teachings of the references would have suggested to those of 
ordinary skill in the art. See In re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981). 

In this case, Arnold teaches that installing the computer data on a model 
machine to check for virus because it is the safest and most reliable way of check for 
viruses (see column 8 line 28-60). This would not change the principle of operation of Ji 
it would increase the effectiveness of the virus screener. 

(11) Related Proceeding(s) Appendix 

No decision rendered by a court or the Board is identified by the examiner in the 
Related Appeals and Interferences section of this examiner's answer. 

For the above reasons, it is believed that the rejections should be sustained. 
Respectfully submitted, 

/Devin Almeida/ /Gilberto Barron Jr/ 

Examiner, Art Unit 21 32 Supervisory Patent Examiner, Art Unit 21 32 

Conferees: 
/Matthew Smithers/ 
Primary Examiner, Art Unit 2137 
/Gilberto Barron Jr/ 

Supervisory Patent Examiner, Art Unit 2132 



